mirror of
https://github.com/hanzoai/forge.git
synced 2026-10-30 15:00:39 +00:00
zeekayandHanzo Dev
9a07b4d089
2978 files. The fork is 2026-07-15 (rebrand: gitea.dev -> github.com/hanzoai/git), so 2026 is the year, and "Copyright 2026 Hanzo AI, Inc." was already the form used by the handful of files that had ours. Shape is now: // Copyright 2026 Hanzo AI, Inc. All rights reserved. // Copyright 2015 The Gogs Authors. All rights reserved. // Copyright 2019 The Gitea Authors. All rights reserved. // SPDX-License-Identifier: MIT Ours on top, theirs retained verbatim. Retained because MIT requires it, and separately because they are true — those authors did write that code. Not renamed to "The Git Authors": Git is a different project under a different license, and putting its name here would attribute this code to people who have nothing to do with it. Adding our line is the fix; overwriting theirs would have been both a licence violation and a false statement. gofmt still reports import-order drift in some of these files. It predates this change (verified against a stash) and is left alone rather than burying a one-line-per-file legal change under 3000 files of unrelated reordering. Build clean. Co-authored-by: Hanzo Dev <[email protected]>
96 lines
3.6 KiB
Go
96 lines
3.6 KiB
Go
// Copyright 2026 Hanzo AI, Inc. All rights reserved.
|
|
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package integration
|
|
|
|
import (
|
|
"net/http"
|
|
"testing"
|
|
|
|
auth_model "github.com/hanzoai/git/models/auth"
|
|
"github.com/hanzoai/git/models/unittest"
|
|
user_model "github.com/hanzoai/git/models/user"
|
|
"github.com/hanzoai/git/modules/setting"
|
|
"github.com/hanzoai/git/modules/test"
|
|
"github.com/hanzoai/git/modules/web"
|
|
"github.com/hanzoai/git/routers/web/auth"
|
|
"github.com/hanzoai/git/services/auth/source/oauth2"
|
|
"github.com/hanzoai/git/services/context"
|
|
"github.com/hanzoai/git/tests"
|
|
|
|
"github.com/markbates/goth"
|
|
"github.com/markbates/goth/gothic"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestOAuth2AvatarFromPicture(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
defer test.MockVariableValue(&setting.OAuth2Client.UpdateAvatar, true)()
|
|
// the SSRF-protected avatar client blocks loopback by default; allow the loopback mock server here
|
|
defer test.MockVariableValue(&setting.Security.AllowedHostList, "loopback,external")()
|
|
|
|
mockServer := createOAuth2MockProvider()
|
|
defer mockServer.Close()
|
|
addOAuth2Source(t, "test-oidc-avatar", oauth2.Source{
|
|
Provider: "openidConnect",
|
|
ClientID: "test-client-id",
|
|
OpenIDConnectAutoDiscoveryURL: mockServer.URL + "/.well-known/openid-configuration",
|
|
})
|
|
authSource, err := auth_model.GetActiveOAuth2SourceByAuthName(t.Context(), "test-oidc-avatar")
|
|
require.NoError(t, err)
|
|
providerName := authSource.Cfg.(*oauth2.Source).Provider
|
|
|
|
t.Run("AutoRegister", func(t *testing.T) {
|
|
defer test.MockVariableValue(&setting.OAuth2Client.Username, "")()
|
|
defer test.MockVariableValue(&setting.OAuth2Client.EnableAutoRegistration, true)()
|
|
defer test.MockVariableValue(&gothic.CompleteUserAuth, func(res http.ResponseWriter, req *http.Request) (goth.User, error) {
|
|
return goth.User{
|
|
Provider: providerName,
|
|
UserID: "oidc-user-ua-pic",
|
|
Email: "[email protected]",
|
|
Name: "OIDC UA Pic",
|
|
AvatarURL: mockServer.URL + "/avatar.png",
|
|
}, nil
|
|
})()
|
|
|
|
req := NewRequest(t, "GET", "/user/oauth2/test-oidc-avatar/callback?code=XYZ&state=XYZ")
|
|
emptyTestSession(t).MakeRequest(t, req, http.StatusSeeOther)
|
|
|
|
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{LoginName: "oidc-user-ua-pic"})
|
|
assert.True(t, user.UseCustomAvatar, "avatar must sync (requires Gitea UA)")
|
|
assert.NotEmpty(t, user.Avatar)
|
|
})
|
|
|
|
t.Run("LinkAccountRegister", func(t *testing.T) {
|
|
const newUserName = "oidc-link-register"
|
|
defer web.RouteMockReset()
|
|
web.RouteMock(web.MockAfterMiddlewares, func(ctx *context.Context) {
|
|
require.NoError(t, auth.Oauth2SetLinkAccountData(ctx, auth.LinkAccountData{
|
|
AuthSourceID: authSource.ID,
|
|
GothUser: goth.User{
|
|
Provider: providerName,
|
|
UserID: "oidc-link-register-sub",
|
|
Email: "[email protected]",
|
|
Name: "OIDC Link Register",
|
|
AvatarURL: mockServer.URL + "/avatar.png",
|
|
},
|
|
}))
|
|
})
|
|
|
|
req := NewRequestWithValues(t, "POST", "/user/link_account_signup", map[string]string{
|
|
"user_name": newUserName,
|
|
"email": "[email protected]",
|
|
"password": "AVeryStrongPassword!1",
|
|
"retype": "AVeryStrongPassword!1",
|
|
})
|
|
emptyTestSession(t).MakeRequest(t, req, http.StatusSeeOther)
|
|
|
|
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: newUserName})
|
|
require.Equal(t, auth_model.OAuth2, user.LoginType)
|
|
assert.True(t, user.UseCustomAvatar, "register-link flow must sync avatar from `picture` claim")
|
|
assert.NotEmpty(t, user.Avatar)
|
|
})
|
|
}
|